CVE-2026-17976 is a vulnerability in Google Chrome's extension system affecting versions before 151.0.7922.72. It involves insufficient enforcement of policies that govern extension behavior, enabling an attacker to bypass discretionary access control if the user installs a malicious extension. The bypass is achieved through manipulation involving a crafted domain name. This vulnerability requires user interaction in the form of installing the malicious extension and is rated low severity by Chromium security.

An attacker who convinces a user to install a malicious extension can bypass discretionary access controls, potentially allowing unauthorized actions within the browser context. However, the impact is limited by the need for user consent to install the extension and the low severity rating indicates limited risk or exploitability.

A fix is available in Google Chrome version 151.0.7922.72 and later. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigations are specified by the vendor advisory.